← All changes | includes/Plugin.php +54 -8 3.6.2 → 3.7.3 View file →

		@@ -17,9 +17,11 @@
17	17	use Templately\API\Conditions;
18	18	use Templately\API\ThemeBuilderApi;
19	19	use Templately\Builder\ThemeBuilder;
20	20	use Templately\Core\Importer\FullSiteImport;
	21	+use Templately\Utils\AuthErrorCode;
21	22	use Templately\Utils\Base;
	23	+use Templately\Utils\Database;
22	24	use Templately\Utils\Enqueue;
23	25
24	26	use Templately\Core\Admin;
25	27	use Templately\Core\Module;
		@@ -26,9 +28,11 @@
26	28
27	29	use Templately\API\Tags;
28	30	use Templately\API\Items;
29	31	use Templately\API\Login;
	32	+use Templately\API\Checkout;
30	33	use Templately\API\SignUp;
	34	+use Templately\API\AiCredit;
31	35	use Templately\API\Profile;
32	36	use Templately\API\Import;
33	37	use Templately\API\MyClouds;
34	38	use Templately\API\WorkSpaces;
		@@ -37,8 +41,9 @@
37	41	use Templately\API\TemplateTypes;
38	42	use Templately\API\SavedTemplates;
39	43	use Templately\API\Sites;
40	44	use Templately\API\Tour;
	45	+use Templately\Core\DeactivationSurvey;
41	46	use Templately\Core\Maintenance;
42	47	use Templately\Core\Migrator;
43	48	use Templately\Core\Platform\Gutenberg;
44	49	use Templately\Core\Platform\Elementor;
		@@ -43,9 +48,9 @@
43	48	use Templately\Core\Platform\Gutenberg;
44	49	use Templately\Core\Platform\Elementor;
45	50
46	51	final class Plugin extends Base {
47		- public $version = '3.6.2';
	52	+ public $version = '3.7.3';
48	53
49	54	public $admin;
50	55	public $settings;
51	56	/**
		@@ -74,8 +79,9 @@
74	79	$this->define_constants();
75	80	$this->set_locale();
76	81
77	82	Maintenance::init();
	83	+ DeactivationSurvey::init();
78	84
79	85	$this->assets = Enqueue::get_instance( TEMPLATELY_URL, TEMPLATELY_PATH, $this->version );
80	86	$this->admin = Admin::get_instance();
81	87	$this->settings = Settings::get_instance();
		@@ -190,11 +196,13 @@
190	196	Items::get_instance();
191	197	SavedTemplates::get_instance();
192	198
193	199	Login::get_instance();
	200	+ Checkout::get_instance();
194	201	SignUp::get_instance();
195	202	Import::get_instance();
196	203	Profile::get_instance();
	204	+ AiCredit::get_instance();
197	205	MyClouds::get_instance();
198	206	WorkSpaces::get_instance();
199	207	Sites::get_instance();
200	208	Tour::get_instance();
		@@ -268,12 +276,46 @@
268	276	if ( empty( $_GET['templately_google_login'] ) ) {
269	277	return;
270	278	}
271	279
272		- $redirect_url = remove_query_arg( [ 'templately_google_login', 'api_key', 'error', 'state', 'redirect-to' ] );
	280	+ if ( wp_doing_ajax() || wp_doing_cron() || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
	281	+ return;
	282	+ }
273	283
274		- if ( ! empty( $_GET['error'] ) ) {
275		- $error_message = sanitize_text_field( $_GET['error'] );
	284	+ // Checked before the token is consumed: the callback can land while the
	285	+ // auth cookie is missing (expired session, cookie not yet set), and WP
	286	+ // will bounce the user through wp-login and back to this same URL.
	287	+ // Burning the token here would fail that legitimate retry.
	288	+ if ( ! is_user_logged_in() ) {
	289	+ return;
	290	+ }
	291	+
	292	+ $state = '';
	293	+ if ( ! empty( $_GET['templately_state'] ) ) {
	294	+ $state = sanitize_text_field( wp_unslash( $_GET['templately_state'] ) );
	295	+ } elseif ( ! empty( $_GET['state'] ) ) {
	296	+ $state = sanitize_text_field( wp_unslash( $_GET['state'] ) );
	297	+ }
	298	+
	299	+ $state_user_id = false;
	300	+ if ( ! empty( $state ) ) {
	301	+ $state_user_id = Database::get_transient( 'google_state_' . $state );
	302	+ Database::delete_transient( 'google_state_' . $state );
	303	+ }
	304	+
	305	+ $is_authorized = false !== $state_user_id
	306	+ && intval( $state_user_id ) === get_current_user_id()
	307	+ && current_user_can( 'delete_posts' );
	308	+
	309	+ $redirect_url = remove_query_arg( [ 'templately_google_login', 'templately_state', 'api_key', 'error', 'state', 'redirect-to' ] );
	310	+
	311	+ if ( ! $is_authorized ) {
	312	+ $error_code = AuthErrorCode::AUTH_STATE_INVALID;
	313	+ } elseif ( ! empty( $_GET['error'] ) ) {
	314	+ // Google's own reason is deliberately dropped rather than forwarded:
	315	+ // everything on this query string is attacker-controlled, and the
	316	+ // screen that displays it must never be handed prose from the URL.
	317	+ $error_code = AuthErrorCode::AUTH_PROVIDER_FAILED;
276	318	} elseif ( ! empty( $_GET['api_key'] ) ) {
277	319	$request = new \WP_REST_Request( 'POST', '/templately/v1/login' );
278	320	$request->set_param( 'viaAPI', true );
279	321	$request->set_param( 'api_key', sanitize_text_field( $_GET['api_key'] ) );
		@@ -282,8 +324,11 @@
282	324	* @var Login $login
283	325	*/
284	326	$login = Login::get_instance();
285	327	$login->permission_check( $request );
	328	+
	329	+ // login() pins the write target to the acting user itself — no pin
	330	+ // here, or its finally would release ours mid-request.
286	331	$response = $login->login();
287	332
288	333	if ( ! is_wp_error( $response ) && ! empty( $response['user'] ) ) {
289	334	$redirect_path = ! empty( $_GET['redirect-to'] ) ? sanitize_text_field( wp_unslash( $_GET['redirect-to'] ) ) : '';
		@@ -309,17 +354,18 @@
309	354
310	355	wp_safe_redirect( $redirect_url );
311	356	exit;
312	357	} else {
313		- $error_message = ( is_wp_error( $response ) ) ? $response->get_error_message() : __( 'Login failed.', 'templately' );
	358	+ // The cloud's own wording stays server-side; the screen resolves
	359	+ // its copy from the code.
	360	+ $error_code = AuthErrorCode::INVALID_API_KEY;
314	361	}
315	362	} else {
316		- $error_message = __( 'Missing API Key.', 'templately' );
	363	+ $error_code = AuthErrorCode::AUTH_MISSING_API_KEY;
317	364	}
318	365
319	366	$redirect_url = add_query_arg( [
320		- 'templately_error' => 'login_failed',
321		- 'error_message' => urlencode( $error_message ),
	367	+ 'templately_error' => $error_code,
322	368	], $redirect_url );
323	369
324	370	wp_safe_redirect( $redirect_url );
325	371	exit;